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EXECUTIVE  SUMMARY 

Internal  management  controls  are  not  new,  they  have  been 
around  since  1921.  Reported  cases  of  break  downs  in  controls 
created  the  perception  of  the  taxpayer  that  the  government  loses 
billions  of  tax  dollars  through  fraud,  waste,  and  abuse.  The 
Federal  Managers  Financial  Integrity  Act  and  the  Office  of 
Management  and  Budget  Circular  A-123  established  internal 
management  controls  to  safeguard  government  assets.  Department  of 
Defense  implemented  these  controls .  However,  each  service  and 
agency  supplemented  DOD  procedures  to  execute  the  internal 
management  control  program.  Each  service  and  agency  has  the  same 
objective  of  safeguarding  government  assets  but  varies  in 
implementation.  A  single  regulation  standardizing  procedures  to 
execute  the  program  is  overdue.  A  single  regulation  will  eliminate 
the  extra  cost  and  efforts  required  to  publish  each  services 
internal  management  control  regulation.  In  addition  future 
strategies  utilizing  joint  forces  operations  necessitate  a  common 
set  of  rules  to  achieve  internal  management  control  objectives 
successfully .  Recommend  that  DOD  consolidate  OMB  A-123  guidance 
into  one  regulation  applicable  to  all  services . 
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The  Army,  Air  Force,  Navy  and  Department  of  Defense  (DOD)  have 
different  procedures  for  implementing  internal  management  controls 
as  required  by  the  Federal  Managers  Financial  Integrity  Act  (FMFIA) 
of  1982  and  Office  of  Management  and  Budget  (OMB)  Circular  A-123. 
Each  agency  pursues  the  same  objective  of  safeguarding  government 
assets  from  fraud,  waste,  and  abuse.  The  new  strategy  of  joint 
forces  operation  creates  the  necessity  for  DOD  to  establish  a  joint 
regulation .  The  new  regulation  should  standardize  procedures  for 
all  services .  A  joint  regulation  will  reduce  breakdowns  in 
management  controls  when  crossing  from  one  service  into  another 
service's  responsibility.  How  severe  and  deadly  a  breakdown  in 
management  controls  can  be  is  demonstrated  by  the  downing  of  an 
Army  helicopter  by  friendly  fire  over  Saudi  Arabia  earlier  this 
year.  Another  benefit  of  a  joint  regulation  is  the  saving  of 
quadrupled  efforts  and  costs  by  each  service  to  develop  and  publish 
separate  regulations.  This  change  would  support  the  new  joint 
forces  strategy  and  be  a  positive  milestone  in  the  infamous  history 
of  the  internal  management  control  program.  In  this  paper  I  will 
be  discussing  how  the  internal  management  control  program  evolved, 
its  statutory  requirements ,  and  compare  the  DOD,  Army,  Air  Force 
and  Navy  interpretation  of  execution  of  the  internal  management 
control  program.  '  The  differences  in  program  execution  provide  the 
basis  for  my  theory  of  consolidating  into  one  regulation  for  all 
services  and  other  components  of  DOD. 

Historically,  the  origin  of  the  Internal  Management  Control 
Program  is  in  the  Accounting  and  Auditing  Act  of  1921  with  the  act 
being  reemphasized  in  1950.  This  act  identified  the  responsibility 


for  department  heads  to  establish  an  adequate  system  of  internal 
management  controls .  While  the  requirements  were  on  the  books, 
very  little  operational  attention  was  addressed  to  the  issue  of 
internal  management  controls .  Over  the  past  several  years,  the 
disclosure  of  significant  cases  of  fraud,  waste,  and  abuse  in 
programs  administered  at  all  levels  of  government  created  the 
perception  of  poor  management.  Key  officials  recognized  that  the 
only  effective  solution  to  problems  resulting  from  illegal, 
unauthorized,  or  questionable  action  was  to  take  a  critical  look  at 
the  basic  safeguards  and  establish  an  effective  review  of 
management  controls  that  could  detect  deficiencies  in  control, 
design,  and  selection .  New  statutory  requirements  were  established 
to  support  internal  management  controls  throughout  government 
agencies . 

The  statutory  basis  for  the  internal  management  control  program 
is  the  FMFIA  of  1982  (Public  Law  97-255)  .  The  FMFIA  mandates 
requirements  for  strengthening  internal  management  controls 
throughout  government.  Specifically  the  FMFIA  requires  that  all 
agencies'  control  systems  be  periodically  evaluated  against 
standards  developed  by  the  Comptroller  General  and  that  the  heads 
of  the  agencies  report  annually  on  their  internal  management 
control  program  status  via  the  chain  of  command  through  Congress  to 
the  President .  OMB  Circular  A-123  implements  FMFIA  within  the 
Execution  Branch  of  the  Government.  Revised  in  1983  and  1986,  the 
Circular  mandates  that  each  agency  establish  a  cost  effective 
system  of  internal  management  controls .  The  system  should  provide 
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reasonable  assurance  that  government  resources  are  protected 
against  fraud,  waste,  abuse  and  mismanagement,  and  that  the  program 
is  effectively  and  efficiently  managed  to  achieve  the  goals  of  the 
agency  (1:1-12).  DOD  published  DODD  5010.38  to  implement  OMB 
Circular  A-123.  This  directive  allowed  leeway  for  agencies  and 
services  to  establish  their  own  internal  management  control 
programs,  and  left  room  for  interpretation  as  to  how  the  program 
should  be  executed.  Each  service  has  its  own  regulation  or 
instructions :  for  the  Army,  it's  Army  Regulation  11-2,  for  the  Air 
Force,  it's  Air  Force  Instruction  65-201,  and  for  the  Navy,  it's 
Secretary  of  the  Navy  Instruction  5200 . 35C .  To  show  the  difference 
in  the  execution,  a  short  synopsis  concentrating  on  the  major 
differences  of  each  service's  internal  management  control  program 
implementation  is  necessary  for  comparison. 

DOD  guidelines  for  the  internal  management  control  programs 
require  each  component  to  implement  a  comprehensive  system  that 
provides  reasonable  assurance  that  government  assets  are 
safeguarded  from  fraud,  waste,  and  abuse.  Services  must 
incorporate  in  their  internal  management  control  program  critical 
steps  such  as: 

*  Segmenting  their  organization  into  assessable  units. 

*  Conducting  a  risk  assessment  at  least  every  five  years 
to  establish  each  activity's  vulnerability. 

*  Establishing  a  scheduled  evaluation  cycle  based  on  the 
high,  medium  or  low  risk  assessment . 

*  Consolidating  scheduled  evaluation  cycles  into  a  master 
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control  plan  advising  assessable  unit  managers  when 
mandatory  internal  management  control  reviews  are  due. 

*  Establishing  a  material  weakness  report  with  a  corrective 
action  plan  for  each  control  that  is  not  effective  or  has 
not  been  established. 

*  Tracking  material  weaknesses  until  corrected. 

*  Submitting  the  annual  statement  of  assurance  to  include 
reportable  material  weaknesses  (2:1-7). 

Interpretation  as  to  how  the  internal  management  control  program 
should  be  executed  was  left  to  the  discretion  of  each  DOD 
component . 

The  Army  has  accomplished  a  complete  revision  of  their 
internal  management  control  program  and  is  implementing  the  new 
" Management  Control  Process"  during  fiscal  year  95.  The  name  of 
the  program  was  changed  to  emphasize  that  it  is  a  management  and 
not  an  administrative  requirement  as  perceived  by  many  managers. 
This  new,  aggressive  approach  is  tailored  to  meet  the  requirements 
prescribed  by  OMB  and  DOD,  and  is  a  positive  step  in  fighting  the 
loss  of  an  estimated  45  billion  dollars  of  taxpayers'  monies 
through  fraud,  waste  and  abuse.  The  new  policy  establishes  a 
senior  management  council  to  advise  the  Secretary  of  the  Army  on 
management  control  matters .  Functions  and  organizations  are 
segmented  into  assessable  units  at  grade  levels  not  lower  than 
Colonel  or  GS  15.  This  ensures  top  level  management  emphasis  by 
giving  them  stewardship  of  the  management  control  process.  Each 
senior  assessable  unit  manager  must  establish  a  management  control 
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administrator  (MCA)  to  administer  the  management  control  process . 
The  MCA  acts  in  an  advisory  capacity  to  management  and  focuses  on 
management  control  matters.  The  MCA  ensures  managers  are  trained 
and  that  material  weakness  are  tracked  until  corrected . 
Furthermore ,  Headquarters  Department  of  the  Army  (HQDA)  has  the 
responsibility  to  establish,  through  their  functional  proponents , 
a  detailed  risk  assessment .  Based  on  the  risk,  a  master  control 
plan  (MCP)  will  be  developed.  All  Army  regulations  are  being 
revised  during  fiscal  year  1995  to  include  key  management  controls , 
a  streamlined  management  control  review  checklist,  and  document 
alternative  review  methods  already  in  use.  It  leaves  the  use  of 
the  published  checklist  to  the  discretion  of  each  manager.  An 
alternative  review  method  could  be  used  if  so  desired,  but  has  to 
be  noted  in  the  assessable  units  MCP.  This  change  eliminates 
publishing  the  long  Internal  Management  Review  Checklist  in  the  DA 
circular  11  series.  These  are  the  more  significant  changes  in  the 
Army '  s  program  (3:1-6)  . 

The  Air  Force  has  a  more  liberal  approach  and  places  the 
responsibility  at  the  lowest  assessable  unit  of  a  subdivision 
within  its  organization.  The  lowest  assessable  unit  manager  is 
responsible  for  conducting  a  vulnerability  assessment  of  his/her 
organization  and  establishing  the  unit's  risk  level  in  regards  to 
fraud,  waste,  and  abuse.  Managers  are  free  to  develop  their  own 
review  methods  by  either  developing  a  checklist  or  to  utilize 
alternative  review  methods  already  in  existence .  They  will 
publish  these  methods  in  their  master  control  plan.  The  assessable 
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unit  manager  must  focus  on  controls  which  are  excessive ,  and  need 
improvement  or  elimination  (4:1-6).  This  liberal  approach  has  not 
been  successful  for  the  Air  Force  based  on  their  previous  material 
weaknesses  track  record. 

The  Navy  applies  basically  the  same  principles  as  the  Air 
Force.  Their  policy  allows  the  manager  a  certain  percentage  of 
loss,  depending  on  the  category,  before  it  becomes  reportable  as  a 
material  weakness .  The  Navy  has  adopted  and  applied  the  Total 
Quality  Management  (TQM)  concept  in  their  internal  management 
control  program.  The  Navy's  philosophy  is  that  TQM  is  a  cultural 
change  which  focuses  on  fixing  the  process.  As  these  processes  are 
improved,  there  would  be  less  need  to  conduct  a  100  percent  review 
of  the  assessable  units,  leaving  more  time  to  focus  on  improving 
the  ability  to  meet  the  mission  of  the  organization  (5:1-5) .  TQM 
can  enhance  the  execution  of  the  internal  management  control 
program  but  has  a  tendency  to  reduce  the  importance  of  the  program 
if  not  applied  properly.  It  should  not  be  used  as  a  substitute  for 
the  program. 

In  summary,  history  has  proven  that  although  the  government  has 
taken  positive  steps  to  fight  fraud,  waste  and  abuse  it  is  still 
extremely  vulnerable .  DOD  and  its  components  are  complying  with 
FMFIA  and  OMB.  The  execution  of  the  internal  management  control 
program  by  each  service  has  a  different  yet  similar  approach, 
leaving  weak  areas  open  such  as  crossing  from  one  service  into 
another  service's  responsibility. 

The  different  approaches  by  each  service  in  the  execution  of 
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the  internal  management  control  program  is  overdue  a  revision  to 
meet  FMFIA  and  OMB  requirements .  TQM,  as  used  by  the  Navy,  can  be 
an  excellent  tool  to  enhance  internal  management  controls .  However 
TQM  should  not  be  used  as  a  substitute  for  internal  management 
controls .  The  Army  is  taking  the  right  steps  to  correct  the 
problems  associated  with  fraud,  waste  and  abuse.  Future  joint 
forces  operations  require  common  control  measures  for  all  services . 

I  recommend  DOD  combine  all  services'  internal  management 
control  program  directives /instructions /regulations  into  one 
publication  with  common  execution  procedures  and  objectives  for  all 
services .  This  unified  effort  will  reduce  material  weaknesses , 
produce  dollar  and  time  savings  through  one  publication  and  reduce 
the  negative  perception  of  the  taxpayer.  We  must  be  pro-active  - 
we  have  been  known  to  close  the  barn  doors  after  the  horse  has 
escaped. 
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